Mac OS 9 Serial Number Archive

home *** CD-ROM | disk | FTP | other *** search

/ Mac OS 9 Serial Number Archive / SN Archive 2023.11.04.toast / Cracking Texts / Hackintosh Bible v1.4 / Hackintosh Bible v1.4.rsrc / TEXT_132.txt < prev next >

Wrap

Text File | 1997-05-07 | 17.4 KB | 304 lines

the draping of their releases with corporate motifs - logos, front ends, graphics, even signature tunes and Java applets - crackers' true identities typically remain secret, even to one another. The anonymity, however, works both ways. Cloaked in his own secret identity, Phil says he has managed to get deep within several major groups in the past 18 months and is skimming the surface of several others. He can convincingly portray himself as a caring, sharing warez god. "You make some good friends," he says with a smile. And, it seems, you can end up pretty impressed. "Some of these people are incredibly talented. The logic and programming behind their setups are just amazing." Or maybe he's just bluffing? Warez and whyfores In Phil's world, warez dealers are thieves. In warez world, the software companies are the criminals. "Most products you buy from a store can be returned if you are unsatisfied," reads the beautifully crafted Warez FAQ, on the Inner Circle's Web site. "Software cannot." The Inner Circle thus can claim to have a practical motivation - providing "a place to find something you might want to evaluate before purchasing." All right. "I personally have bought progs that I demo'd first from warez," declares Clickety. "I have more warez than I could ever hope to install on my poor drives. Tested a lot of crap also that I was glad I didn't pay for - deleted it right off the bat. I have recommended software to clients based upon using a pirate version at home." "Software developers have families, and should be able to support them," reads the Warez FAQ. "We do advocate buying your own software if you really like it and use it heavily," adds Mad Hatter. As Phil and his friends are well aware, the line between piracy and ownership is very blurred. For example, it's commonplace for 3-D animators and modelers to use pirated, cracked, or at least unlicensed copies of their office software at home, for overtime or experimentation. In some minds, it's even a "necessary evil," a slightly arcane marketing strategy, a rather reckless approach to branding - look at Netscape. Indeed, many software executives privately acknowledge that piracy - especially the attention it brings to new releases - can be a valuable way to develop markets. Novell's Martin Smith might disagree. He spends "99.9 percent" of his time fighting piracy, and he worries that the next generation of browsers will seamlessly marry the Web with Usenet. "The newsgroups will be a lot more accessible," he says, with something close to resignation, "which is going to make the whole thing a lot more widespread and give these guys a much bigger market. There's not much we can do, other than encourage ISPs not to take them." The difficulty is that, once it's up, a Usenet post can generally be canceled only by the author or a sysop from the post's point of origin, "server zero." Even if a cancel is issued, it takes time to ripple across the network. A warez regular would be able to grab the file before it was vaped. Some servers refuse on principle to honor cancels. "Even the most diehard warez hater in news.admin.hierarchy would defend your right to be safe from cancels," claims TAG. Many commercial ISPs have taken the industry's encouragement and dropped the warez groups, but lots of free servers are carrying on. And things aren't helped by the lack of a clear legal framework. Imagine the scenario: a program that belongs to a UScompany is uploaded via a router in Canada to a server in South Africa, where it is downloaded by a Norwegian operating out of Germany using a US-based anonymous remailer, then burnt onto a CD in the UK and sold in Bulgaria. "How would you prosecute that mess?" asks Smith. "It's a jurisdictional nightmare." And the profit pirates are getting more creative. Smith cites the Web page of one warez guru, offering a premium-line phone number: for $3 a minute, you can listen to details about the best warez FTP sites, their addresses, and their login passwords. "Updated every three days for your convenience," it declares. It also makes provisions for those dialing from outside the US. The selling of information that leads to illegal use of information - a difficult case to prosecute. "Our strategy is to bring a critical mass of prosecutions," says Smith. "We'll take out some people who're downloading this material - the gnats - and then we'll take out some of the larger, more organized guys. The people who are packaging it up and zipping it onto CD-ROMs." Which might work in a world where software was always bought on CD-ROM. But in pushing ever deeper into electronic commerce, where more and more real commercial software (browsers, little applets) is being given out for free, where the Internet is the ultimate distribution network, this looks a little ropey. Friction-free markets and friction-free piracy run in tandem. The Inner Circle already has its PGP-encoded giveaway mall in place. Smith knows all this. There's just not much he can do about it. "All it needs is one server in one country where there are no laws to counter copyright theft, and there are plenty who will - the likes of Libya, Bulgaria, and Iran. One country with a decent enough telephone infrastructure is enough to undo a hundred busts in the West." Even if laws are constitutional or enforced, larger biases come into play. "Try asking a Saudi policeman to arrest a Saudi software pirate on behalf of an American company. Forget it." Dingle my dongle The alternative to policing is burglar-proofing: making things harder to crack. In principle, you might think that the gazillion-dollar software industry would be able to produce uncrackable software. In practice, it can't, although it certainly keeps trying. Take the dongle, for example. It is the summit of copy protection, an explicit melding of software and hardware. Without the right hardware key - the dongle - plugged into the machine's parallel port, the software won't run. And without the right software, the dongle is a mindless doorstop. Calls to the dongle are woven into the code at the lowest level. "The program may call the dongle every 150 mouseclicks, or every time you print, or every time you select flesh tones as your desktop color scheme," says one dongle expert. If the response to the call is false or not forthcoming, the program shuts down. All communications between the two are encrypted by uncrackable algorithms. Internal security fuses ensure that any attempt to hack the dongle mechanically will cause it to self-destruct. "Nothing short of an electron microscope," says the expert, "could extract the algorithm from that mess." The biggest player in the dongle market is Rainbow Technologies, whose Sentinel hardware keys are used by 55 percent of all protected software. There are 8 million Sentinel keys attached to 8 million printer ports the world over. The company calls it "the world's most effective way to stop piracy" - a clarion call to crackers if ever there was. The logical approach to cracking a hardware key is to create a "pseudodongle" - a chunk of code that sits in memory, giving the correct answers to any query. To do this, a cracker would have to monitor and trap traffic to-ing and fro-ing across the parallel port, then use this information to build an infallible query/response table. Unfortunately, if the query is, say, six characters long, it can have more than 280 trillion responses (281,474,976,710,700 to be exact). With the speed of modern machines, this would take approximately 44,627 years to collate. With the SentinelSuperPro dongle ("the most secure and flexible protection available") the query length can be 56 characters - requiring a mere 10 125 years (in theory) for a complete table. However, the dongle in SentinelSuperPro for Autodesk 3D Studio MAX was cracked in just under seven days of its retail release - substantially less than the 44 millennia emblazoned on the sales brochures. Other expensive high-end applications that use Sentinel - including NewTek's LightWave 5 and Microsoft's SoftImage - have ended up the same way: cracked, repackaged, and redistributed to every corner of the Internet within weeks of their release. How? Instead of attempting to simulate the dongle, expert crackers simply remove its tendrils from the program code, unraveling the relationship skein by skein, function by function, call by call, until the application ceases to need the dongle to function. Then it's ready for anyone and everyone to use - or, more likely, gawk at. Nobody says this is easy. There may be only three or four crackers in the world who could manage such an opus. But with the Internet to transmit the result, only one needs to succeed. With the latest wave of dongles, warez world looked to Russia to get the job done - and a shadowy group called DOD "won" the contract. The self-styled "Warez Bearz of Russia and Beyond," DOD appears to have arms throughout Europe, Asia, and the US. It undid Microsoft SoftImage's dongle protection in two weeks, which wasn't easy. The crew riotously celebrated in their "NFO" file: "Totally awesome work of glorious DOD cracker - Replicator after five other crackers gave up! We decided not a do a crack patch 'coz it will take too much time to code it ... you ask why? 'Coz there are only 72 (!!!) EXEs patched. All options now work 100%!" NFO files do more than brag or supply installation instructions; they testify that the ware is a bona fide release, guaranteed to work. And this is more than just posturing; a group's reputation is paramount. Each release is painstakingly beta-tested. These are their products now, their labors of love. Nobody wants to find a "bad crack" in his hands after a seven-hour download. Nobody wants to be accused of being "unprofessional." Nobody wants the ignominy of anything like the bad crack for Autodesk's 3D Studio that made the rounds in 1992. For all intents and purposes it ran correctly, all features seemed 100 percent functional. Except that the dedongled program slowly and subtly corrupted any 3-D model built with it. After a few hours of use, a mesh would become a crumpled mass of broken triangles, irrevocably damaged. Cleverly, Autodesk had used the dongle to create a dynamic vector table within the program. Without the table, the program struggled to create mathematically accurate geometry - and eventually failed. Many a dodgy CAD house saw its cost-cutting measures end in ruin. Autodesk support forums and newsgroups were flooded with strangely unregistered users moaning about the "bug in their version of 3D Studio." A rectified "100 percent cracked" version appeared soon after, but the damage was done. The Myth of the Bad Crack was born, and the pirate groups' reputations tarnished. But the pirates bounced back. They always do. And there's no reason to think that there's any way to stop them. Software security people are at an intrinsic disadvantage. Compare their job to that of securing something in the real world that's valuable and under threat - a bank, say. Typically, only one set of armed robbers will hold up a bank at a time, and they'll get only one crack at it. Imagine an army of robbers, all in different parts of the world, all attacking the same bank at the same time. And in the comfort of their own homes. Not just once, but over and over again. Imagine that each set of robbers is competing against every other, racing to be first in. Imagine, too, that some of the robbers are so technically adept that they could have built the alarms, the safe, and even the jewels themselves. And that they have cracked more than 30 banks with the same protection system. And that they're learning from all their failures, because they're never caught. No security could realistically resist such an onslaught. It may be that the only way to avoid having your software cracked is to put no protection whatsoever on it. No challenge, no crack. Popularity only feeds the frenzy. Doom is a good example. In 1993, id Software distributed the original shareware version of its nasty-guns-in-nasty-dungeons masterpiece on bulletin boards, CompuServe, and a then-little-known system called the Internet. Downloaded by more than 6 million people worldwide, Doom was a trailblazer in the world of modem marketing. The shareware gave you a third of the game: if you liked it, you had to buy the rest on disks. Millions did. Doom and its makers became a dream target. Weeks before Doom II's release, the sequel was available on the Internet - not as shareware, but warez. And not just as a teaser, but the whole damn thing. "Yeah, that was leaked," says Mike Wilson, id's then-vice president of marketing, now CEO at Ion Storm. "Can't tell you how much that hurt." The leaked copy was rapidly traced - rumors abounded that the version was a review copy fingerprinted to a British PC games magazine - but too late. It was already on Usenet, doing the rounds on IRC, filling up FTP sites. The pirates were in ecstasy and id was left with recoding the final retail release, to ensure future patches and upgrades would not work on the pirated version. Then they shut the stable door. No more external beta testing; no more prelaunch reviews. "We assured ourselves it would never happen again," says Wilson. "No copy of our games would leave the building." Nice try. Quake, Doom's much-anticipated follow-up, turned up on an FTP server in Finland three days before the shareware come-on was due to be released. The pirate version was a final beta of the full game - complete with eerily empty unfinished levels and bare, unartworked walls. Within hours, it had been funneled to sites all over the globe. IRC was swamped with traders and couriers desperate to download. "Somebody actually broke into our then poorly secured network and started to download it right before our eyes," Wilson recalls. "We managed to stop the transfer before he got all of it. We traced the call, got his name and address. He was pretty scared, but, of course, it was some kid. We didn't pursue that one. It hurt, but not enough to put some little kid in jail." When the legitimate Quake hit the stores last year, it was initially in the form of an encrypted CD, which let you play a shareware version for free but would only unlock the rest on receipt of a password, available for purchase by phone. The encryption scheme, an industry standard called TestDrive, was eventually cracked by a lone European pirate called Agony. And id's crown jewel was now available, courtesy a 29K program. "In order to unlock the full version, you are supposed to call 1-800-IDGAMES," Agony gloated in a posting. "Hahahahahah." "We knew it was going to be hacked," says Wilson. "We of all people knew. But we thought it was safe enough, certainly safer than Doom II." And, truth to tell, it didn't matter too much. The gap between the game's release and the warez version becoming widespread was enough for id to sell the copies they expected. "Copy-protection schemes are just speed bumps," laments Wilson. Nobody really knows how much actual damage cracking does to the software companies. But as the industry rolls apprehensively toward the uncertain future of an ever-more frictionless electronic marketplace, almost everyone thinks piracy will increase. "The level of activity out there is overwhelming. We know that we have to take action to take control of it. We will continue to bring a critical mass of prosecutions," says Novell UK's Smith. He doesn't sound all that convinced. Somewhere back on the US East Coast, Mad Hatter has a final swig of ginger ale and settles down to bed with his wife, White Rabbit. She thinks his obsession is a wasted resource, but didn't complain when he installed the latest version of Quicken on her computer - a cracked copy, of course. "We are all family men, married with children, day jobs, dedicated accounts, and multiple phone lines," Mad Hatter says. "Our kids have been looking over our shoulders for years. They will be the next couriers, the next warez gods." __________________ David McCandless (dmacca@cix.compulink.co.uk), a London-based writer, musician, and film editor, is still bitter about being dethroned as UK Doom champion. T H R E A D S : 37 topics. Copyright ¬© 1993-97 Wired Magazine Group, Inc. Compilation copyright ¬© 1994-97 HotWired, Inc. All rights reserved.